Upload
thiyagarajan
View
68
Download
5
Tags:
Embed Size (px)
Citation preview
1© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Explaining Wireless LAN Technology & Standards
BCMSN Module 6 Lesson 3
2© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Objectives
Identify the characteristics of the 802.11b standard.
Identify the characteristics of the 802.11a standard.
Identify the characteristics of the 802.11g standard.
Compare and contrast the 802.11a/b/g standards.
Describe common Wireless LAN security threats.
Describe ways to mitigate common security threats.
3© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Unlicensed Frequency Bands
ISM: Industry, Scientific, and Medical frequency band
No license required
No exclusive use
Best effort
Interference possible
4© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Radio Frequency Transmission
Radio frequencies are radiated into the air via an antenna, creating radio waves.
Radio waves are absorbed when they are propagated through objects (e.g. walls).
Radio waves are reflected by objects (e.g. metal surfaces).
This absorption and reflection can cause areas of low signal strength or low signal quality.
5© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Radio Frequency Transmission
Higher data rates have a shorter transmission range.The receiver needs more signal strength and better SNR to retrieve information.
Higher transmit power results in greater distance.
Higher frequencies allow higher data rates.
Higher frequencies have a shorter transmission range.
6© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
WLAN Regulation and Standardization
Regulatory agenciesFCC (United States)
ETSI (Europe)
StandardizationIEEE 802.11
http://standards.ieee.org/getieee802/
Certfication of equipmentWi-Fi Alliance certifies interoperability between products.
Certifications include 802.11a, 802.11b, 802.11g, dual-band products, and security testing.
Certified products can be found at http://www.wi-fi.org.
7© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11
Standards and Implementation Process
Cisco
Standards Group CompanyIndustry Group
The Nature of Engineers and the “Design-by- Committee” Environment Mean the IEEE Often Defines Overly Feature Rich Standards with Many Options
The Industry Bodies’ Role Is Remove Much of the “Bloat” Introduced as “Features” into the IEEE Standards, Often by People Not Even Selling Equipment
Cisco® Adds Differentiating Features to the “Minimal” Set Defined by Wi-Fi; in the Past, This Has Included More Security.
“Feature Bloat”“Differentiated
Features”“Minimal Features”
WiFi
8© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11b
9© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11b Standard
Standard was ratified in September 1999
Operates in the 2.4-GHz band
Specifies Direct Sequence Spread Spectrum (DSSS)
Specifies four data rates up to 11 Mbps1, 2, 5.5, 11 Mbps
Provides specifications for vendor interoperability (over the air)
Defines basic security, encryption, and authentication for the wireless link
Is the most commonly deployed wireless LAN standard
10© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Channel Identifi
er
Channel Center
Frequency
Channel Frequency
Range [MHz]
Regulatory Domain
AmericasEurope, Middle
East, and Asia
Japan
1 2412 MHz 2401 – 2423 X X X
2 2417 MHz 2406 – 2428 X X X
3 2422 MHz 2411 – 2433 X X X
4 2427 MHz 2416 – 2438 X X X
5 2432 MHz 2421 – 2443 X X X
6 2437 MHz 2426 – 2448 X X X
7 2442 MHz 2431 – 2453 X X X
8 2447 MHz 2436 – 2458 X X X
9 2452 MHz 2441 – 2463 X X X
10 2457 MHz 2446 – 2468 X X X
11 2462 MHz 2451 – 2473 X X X
12 2467 MHz 2466 – 2478 X X
13 2472 MHz 2471 – 2483 X X
14 2484 MHz 2473 – 2495 X
2.4-GHz Channels
11© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
2.4-GHz Channel Use
Each channel is 22 MHz wide. North America: 11 channels Europe: 13 channels There are three nonoverlapping channels: 1, 6, 11. Using any other channels will cause interference. Three access points can occupy the same area.
12© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11b/g (2.4 GHz) Channel Reuse
13© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11b Access Point Coverage
14© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11a
15© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11a Standard
Standard was ratified September 1999
Operates in the 5-GHz band
Uses orthogonal frequency-division multiplexing (OFDM)
Uses eight data rates of up to 54 Mbps6, 9, 12, 18, 24, 36, 48, 54 Mbps
Has from 12 to 23 nonoverlapping channels (FCC)
Has up to 19 nonoverlapping channels (ETSI)
Regulations different across countriesTransmit (Tx) power control and dynamic frequency selection required (802.11h)
16© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Europe 30dBm23dBm
5.15 5.35 5.470 5.725 5.8255 GHzUNII Band
5.25
UNII-117dBm
UNII-224dBm
US (FCC)
11 Ch 4 Ch4 Ch4 Ch
To Be Defined
UNII-1: Indoor Use, Antenna Must Be Fixed to the RadioUNII-2: Indoor/Outdoor Use, Fixed or Remote Antenna
(Must Implement 802.11h After Jul 19, 2007)UNII-3: Indoor/Outdoor; Fixed, Pt-to-Pt Can Employ Higher Gain AntennaEurope: Must Implement 802.11h
Understanding the 5 GHz Spectrum
UNII-330dBm
17© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
IEEE 802.11hSpectrum Management
Primary use of 5 GHz bands outdoors is radar in many countries.
802.11h is an addition to the 802.11 family of standards.
802.11h rules are designed to minimize interference.
Uses Dynamic Frequency Selection (DFS) and Transmit Power Control (TPC).
Radios must comply to benefit from 11 new channels.
18© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11a Channel Reuse
802.11h DFS not availableManual channel assignment required
802.11h DFS implementedChannel assignment done by Dynamic Frequency Selection (DFS)
Only frequency bands can be selected
19© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11g
20© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11g Standard
Standard was ratified June 2003
Operates in the 2.4-GHz band as 802.11b
Same three nonoverlapping channels: 1, 6, 11
DSSS (CCK) and OFDM transmission
12 data rates of up to 54 Mbps1, 2, 5.5, 11 Mbps (DSSS / 802.11b)
6, 9, 12, 18, 24, 36, 48, 54 Mbps (OFDM)
Full backward compatiblity to 802.11b standard
21© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11g Protection Mechanism
802.11b/g AP communicates with 802.11b clients with max. 11 Mbps.
802.11b/g AP communicates with 802.11g clients with max. 54 Mbps.
802.11b/g AP activates RTS/CTS to avoid collisions when 802.11b clients are present.
Additonal overhead reduces throughput.
Problem: 802.11b stations cannot decode 802.11g radio signals.
22© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Self Check
1. What are the 3 non-overlapping channels available in 802.11b/g?
2. Which standards operate in the 2.4-GHz band?
3. What frequency band does 802.11a operate in?
4. Which standards offer data rates of up to 54Mbps?
5. What is data rate shifting?
23© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11 Standards Comparison
24© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11 RF Comparison802.11b – 2.4 GHz 802.11g – 2.4 GHz 802.11a – 5 GHz
Pro
Most commonly deployed WLAN standard
Higher throughput
OFDM technology reduces multipath issues
Highest throughput
OFDM technology reduces multipath issues
Provides up to 23 nonoverlapping channels
Co
n
Interference and noise from other services in the 2.4-GHz band
Only 3 nonoverlapping channels
Distance limited by multipath issues
Interference and noise from other services in the 2.4GHz band
Only 3 nonoverlapping channels
Throughput degraded in the presence of 802.11b clients
Lower market penetration
25© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
802.11 Standards Comparison
802.11b 802.11g 802.11a
Ratified 1999 2003 1999
Frequency band 2.4 GHz 2.4 GHz 5 GHz
No of non-overlapping
channels3 3 Up to 23
Transmission DSSS DSSS OFDM OFDM
Data rates [Mbps]1, 2, 5.5,
111, 2, 5.5,
116, 9, 12, 18, 24,
36, 48, 546, 9, 12, 18, 24,
36, 48, 54
Throughput
[Mbps]Up to 6 Up to 22 Up to 28
26© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
WLAN Industry StandardsNetwork Radio Speeds
IEEE 802.11a/b Ratified
1999 2000 2001 2002 2003
IEEE 802.11g2.4 GHz—OFDM
Up to 54 Mbps
Proprietary
IEEE 802.11a5 GHz—OFDMUp to 54 Mbps
IEEE 802.11b2.4 GHz—DS
Up to 11 Mbps
200620052004
IEEE 802.11nMultichannel
Greater Than 100 Mbps
2007
27© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Range Comparisons
28© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Ratified IEEE 802.11 Standards
802.11: WLAN 1 and 2 Mbps at 2.4 GHz
802.11a: WLAN 54-Mbps at 5 GHz
802.11b: WLAN 11-Mbps at 2.4 GHz
802.11d: Multiple regulatory domains
802.11e: Quality of Service
802.11f: Inter-Access Point Protocol (IAPP)
802.11g: WLAN 54-Mbps at 2.4 GHz
802.11h: Dynamic Frequency Selection (DFS) Transmit Power Control (TPC) at 5 GHz
802.11i: Security
802.11j: 5-GHz channels for Japan
29© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
http://www.cisco.com/go/aironet/compliance
Worldwide Availability
30© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
General Office Wireless LAN Design
Eight 802.11g access points deployed
7 users per access points with no conference rooms provides 3.8 Mbps throughput per user
7 users + 1 conference room (10 users) = 17 total users, provides 1.5 Mbps throughput per user
54 Cubes—4 Conference Rooms
95 Feet
Conference Room
120 Feet
Reception
Conference Room
Conference Room
Conference Room
31© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Activity
Data rate shifting.
Use a laptop to associate to an access point in your area. It is important that you know the physical location of this AP.
Open the wireless management utility to determine the current data rate for your connection.
Move the laptop to an area geographically farther away from the AP. You might also try moving to a room behind a thick wall.
Did your data rate change? What about signal quality?
32© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Self Check
1. What technology is 802.11n based on?
2. What is the 802.11e standard?
3. What wireless standard has the highest throughput, providing up to 28 Mbps throughput?
33© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
WLAN Security
34© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Why WLAN Security?
Wide availability and low cost of IEEE 802.11 wireless equipment
802.11 standard ease of use and deployment
Availability of sniffers Statistics on WLAN security Media hype about
hot spots, WLAN hacking, war driving
Nonoptimal implementation of encryption in standard Wired Equivalent Privacy (WEP) encryption
Authentication vulnerability
35© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Wireless LAN Security Threats
36© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
WLAN Sniffing and SSID Broadcasting
37© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Mitigating the Threats
Control and IntegrityPrivacy and Confidentiality
Protection and Availability
Authentication EncryptionIntrusion Detection
System (IDS)
Ensure that legitimate clients associate with trusted APs.
Protect data as it is transmitted and received.
Track and mitigate unauthorized access and
network attacks.
38© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Identification and protection against attacks, DoS
AES strong encryption
Authentication
Dynamic key management
Evolution of Wireless LAN Security
No strong authentication
Static, breakable keys
Not scalable
Initial (1997)
Encryption (WEP)
Interim (2001)
802.1x EAP
Dynamic keys
Improved encryption
User authentication
802.1x EAP (LEAP, PEAP)
RADIUS
Interim (2003)
Wi-Fi Protected Access (WPA)
Standardized
Improved encryption
Strong, user authentication (e.g., LEAP, PEAP, EAP-FAST)
Present
Wireless IDS
IEEE 802.11i
WPA2 (2004)
39© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Wireless Client Association
1. Access points send out beacons announcing SSID, data rates and other information.
2. Client scans all channels.
3. Client listens for beacons and responses from access points.
4. Client associates to access point with strongest signal.
5. Client will repeat scan if signal becomes low to reassociate to another access point (roaming).
6. During association SSID, MAC address and security settings are sent from the client to the AP and checked by the AP.
40© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
WPA and WPA2 Authentication
41© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
WPA and WPA2 Encryption
42© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Wi-Fi Protected Access
What are WPA and WPA2?Authentication and encryption standards for Wi-Fi clients and APs
802.1x authentication
WPA uses TKIP encryption
WPA2 uses AES block cipher encryption
Which should I use?Gold, for supporting NIC/OSs
Silver, if you have legacy clients
Lead, if you absolutely have no other choice.
GoldWPA2/802.11i• EAP-Fast• AES
Silver
WPA• EAP-Fast• TKIP
Lead
Dynamic WEP • EAP-Fast/LEAP• VLANs + ACLs
43© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
WLAN Security Summary
Open AccessNo Encryption,
Basic Authentication
Public “Hotspots”
Basic Security
40-bit or 128-bit Static WEP Encryption, WPA
Home Use
Enhanced Security
802.1x, TKIP Encryption,Mutual Authentication,
Scalable Key Mgmt., Etc.
Enterprise
Remote Access
VirtualPrivateNetwork (VPN)
Business Traveler, Telecommuter
44© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Security Evaluation
Evaluate effectiveness of encrypted WLAN statistics.
Focus on proper planning and implementation.
Estimate potential security threats and the level of security needed.
Evaluate amount of WLAN traffic being sent when selecting security methods.
Evaluate tools and options applicable to WLAN design.
45© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
ActivityPacket sniffing programs have become more user friendly in recent
years. NetStumbler is one of the easiest packet sniffers to use.
Read this short Wikipedia article about NetStumbler and decide for yourself if you want to download it and explore your wireless network. http://en.wikipedia.org/wiki/NetStumbler
46© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Self Check
1. Describe some common threats to WLANs.
2. Where would “open security” be appropriate?
3. What are 2 types of encryption used by WPA or WPA2?
4. What is an IDS and what security features are enabled by IDS?
47© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Summary
The 2.4-GHz and 5-GHz frequency bands are used by WLAN 802.11 standards.
The throughput per user depends on the data rate and the number of users per wireless cell.
802.11b has data rates of up to 11 Mbps at 2.4 GHz. 802.11a has data rates of up to 54 Mbps at 5 GHz. 802.11g has data rates of up to 54 Mbps at 2.4 GHz. 802.11a has a shorter range than 802.11g. For maximum efficiency, limit the number of users per
cell. Different WLAN security types with authentication and
encryption satisfy the security requirements of enterprise and home users.
48© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Resources
For fee 802 standardshttp://standards.ieee.org (for fee)
Free 802 standardshttp://standards.ieee.org/getieee802/ (Standards are available six months after release for free)
LWAPPhttp://www.ietf.org/html.charters/capwap-charter.html
Mobile Ad-Hoc Networks (MANET)http://www.ietf.org/html.charters/manet-charter.html
Wireless LAN Compatibility Associationhttp://www.wi-fi.org
49© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3
Q and A
50© 2006 Cisco Systems, Inc. All rights reserved. Cisco ConfidentialBCMSN 6 – 3